c133 · Instructions hidden in content: c144 S1's training (2026-11-12)

Written at Mark's word ("Write S1's"), asked in the c142 session after he pointed at the trainings for c144's doomsday scenarios. c144's first scenario, S1 Phishing for financial records, listed this training as wanted. It's built with the /training skill.

First: one addition to the lab world

The lab world had no finding under Prompts are inspected for injection and leakage (P-PROMPT-INSPECT). governance-fixture.ts gained one, marked c133:

• F-H. Jordan's Claude Code on mac-eng-11 (Engineering) read issue #482 "Build fails on arm64" through GitHub MCP, and a hidden comment in it addressed the agent. The finding is medium and Observed, because the policy can only observe. The evidence is worded the way c144's detector words its own (scenarios/detect.ts).
• S-7, its session: triage open issues, 12 tool calls.

It's a different story from S1 on purpose. S1's own finding (TH-S1-b2-1, Priya's Cursor, the email through Gmail MCP) exists only in theatre, and the base world shouldn't repeat it.

Checked after the addition:

• c144's theatre-check.mjs: 164 passed, 0 failed.
• tours-walk.mjs: 455 passed, 0 failed.
• c123-metrics-check.mts: 49 passed.
• Compliance, Reports, Findings, Policies and the policy's page all serve.
• The findings list now holds 24.

Where to look

Captures: the thread "Instructions hidden in content (T-INJECT-1)…" (scripts/shot-programs/c133-inject.json, twelve shots).

What was done

1. The file, app/data/trainings/en/instructions-hidden-in-content.md (T-INJECT-1, 3 minutes, v1). The lesson has four steps:
   • what happened on this machine;
   • why an agent follows text it reads;
   • what Qpoint does about it, with the heuristics read from the policy's configuration and the encoded-payload check that is off;
   • what to do instead: treat outside content as material, keep the agent asking before it sends, posts or deletes, and decline a step you didn't ask for and tell the owner.
   
   The check has four questions, with the right answers third, first, second and third (D34). A Library section rewords the first step for a reading with no finding (D38).
2. The slots. The finding's resource is the MCP server the content came through, the same kind as P-MCP's findings. The kind's slots would have described a sanctioned list, so slots.ts gains POLICY_SLOTS, which wins over the kind.
   • P-PROMPT-INSPECT's slots are via, heuristics, heuristicsOffSentence, outcome and blocked.
   • heuristicSlots is shared with the library's fill.
   • The rule is in authoring.md §Slots.
3. Three scenes, catalogued and mapped:
   • hidden-instruction: content from outside with a hidden line reaching the agent, with the flow animated. It reads via when there is one.
   • one-context: your request and the hidden line read as one.
   • approve-send: the agent asks first, and you decline and tell the owner.
   
   The fourth step reuses mode-observe. The catalogue holds 19.
4. Voice: every filled sentence, scene label and library reading went through check-brand-voice (productUI) with zero violations. The preview page's Voice column reads pass on all 60 texts.
5. Taken end to end in the browser pane:
   • from F-H's strip, through the four steps;
   • a wrong answer, where the retake names step 2;
   • all right, then Finish and record;
   • the history row ("training completed · passed, 4 of 4"), with the finding still open (D9);
   • on its own from the library: all four steps and four questions, nothing left out.
   
   No console errors. Light and dark.

The calls for you

1. Keep F-H in the base world. It's the one row the training answers outside theatre, as F-G is for secrets. Proposed: keep.
2. Slots keyed by policy (POLICY_SLOTS). The alternative is a new resource kind for content ("the email", "issue #482") in the detector and the Resource type, which touches c144's detect.ts and the fixture's types. Proposed: keep the policy key. Revisit if a second policy needs the same thing.
3. "An approval stops the next step." Steps 3 and 4 say the agent asks before it sends, posts or deletes. That's the harness's own permission prompt (Claude Code's, Cursor's), not Qpoint's Tool approval policy (P-TOOL-APPROVAL), which is what stops S1 at beat 5 in replay. Proposed: keep it general. Where P-TOOL-APPROVAL is at Enforce for the person's team, a later version can add a slot that says so.
4. The native app. qnative c9 bundles the published trainings and their scene images (scripts/export-training-scenes.mjs), and T-INJECT-1 isn't bundled there yet. The native S1 (c144, Phase 1, "Yes, both now") will want it. Proposed: re-bundle with the native S1, in whichever session builds it.
5. S1's theatre finding. The training page didn't find TH-S1-b2-1 when opened after the theatre URL in the pane, since theatre doesn't carry across a page load. Reported to the c144 session, which owns the wiring and S1's trainings list.

Ruled (2026-11-13)

Mark walked the five calls one at a time in the c142 session, the day after.

1. Keep F-H, as proposed (D57).
2. Slots keyed by policy, kept as the pattern (D58). Four more policies took it the same day (review-9-wave1.md), and the configuration-only slots became POLICY_CONFIG_SLOTS.
3. "An approval" stays general, as proposed (D59). The approval training (T-APPROVAL-1) now puts the two side by side: Qpoint holds the call under Enforce, and the agent asks.
4. Closed: already done. T-INJECT-1 and its scenes were bundled with the native S1 (qnative 32c9b03).
5. Closed. A link that carries the simulation (?theatre=phishing-financial-records&beat=2) opens the finding every time, and so does the strip's link while the simulation is on in that tab. The bare training URL in a fresh tab has no simulation running, so "no such finding" is the honest answer.